Analysis
-
max time kernel
1s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/04/2025, 23:25
Behavioral task
behavioral1
Sample
dist/Gojo simulator.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral2
Sample
dist/Gojo simulator.exe
Resource
win11-20250410-en
Behavioral task
behavioral3
Sample
dist/mapper/map.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral4
Sample
dist/mapper/map.exe
Resource
win11-20250410-en
General
-
Target
dist/mapper/map.exe
-
Size
5.2MB
-
MD5
4b7ac12256a768c1f344de2f169f5728
-
SHA1
40d63f9cf769b2304420737132cbd6a63a44eb96
-
SHA256
0910c0d226f1f5cb9a6ffaabb70e08b194bbf0b21617beb88109c2cf10987c4e
-
SHA512
e2f50413ba791b0cf6d92922b8f9db59e686837e8d2f9e1a097f0ad72cf59a66a8bbd2c0d5567e059ef2b05dc28aa443ad9409aced4475d55324096abe9abfaf
-
SSDEEP
98304:4uUx/rgmBLSmmoVIuKZxi8MHs6W2ZVci5lQ9pOidDXCc41t7uGkNP:pUx/rdSmmylyxz6zVc03gDyc4gN
Malware Config
Signatures
-
resource yara_rule behavioral4/memory/1572-5-0x00007FF79D0C0000-0x00007FF79D977000-memory.dmp vmprotect behavioral4/memory/1572-7-0x00007FF79D0C0000-0x00007FF79D977000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1572 map.exe 1572 map.exe